bhyve: avoid theoretical stack buffer overflow from integer overflow
Use the proper size_t type to match strlen's return type. This is not exploitable in practice as this parses command line arguments, which are limited to well below 2^31 bytes. This is a minimal change to address the reported issue; hda_parse_config and the rest of this file will benefit from further review. Reported by: Fakhri Zulkifli Reviewed by: jhb, markj MFC after: 3 days Sponsored by: The FreeBSD Foundation
This commit is contained in:
parent
5e80329f9c
commit
aa773f3e23
@ -324,15 +324,14 @@ hda_parse_config(const char *opts, const char *key, char *val)
|
||||
char buf[64];
|
||||
char *s = buf;
|
||||
char *tmp = NULL;
|
||||
int len;
|
||||
size_t len;
|
||||
int i;
|
||||
|
||||
if (!opts)
|
||||
return (0);
|
||||
|
||||
len = strlen(opts);
|
||||
|
||||
if (len >= 64) {
|
||||
if (len >= sizeof(buf)) {
|
||||
DPRINTF("Opts too big\n");
|
||||
return (0);
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user